Compliance terms, in plain language.

An electronic signature that is uniquely linked to the signer, can identify them, is created with data under their sole control, and is tied to the document so that any later change is detectable.

Negative news about a person or company, such as reports of fraud or corruption, checked as part of due diligence.

The person a firm appoints to oversee its anti-money laundering controls and to report suspicions to the authorities. In the UK and Ireland the role is called the MLRO.

The duty to keep copies of identity evidence and transaction records for a set period after the client relationship ends, typically five years.

The laws, controls and checks designed to stop criminals from disguising illegally obtained money as legitimate.

The EU's anti-money laundering authority, based in Frankfurt. It directly supervises the highest-risk financial firms and coordinates national supervisors.

Regulation (EU) 2024/1624, the EU's single anti-money laundering rulebook. It applies directly in every member state from 10 July 2027.

A certificate issued under the 1961 Hague Convention that confirms the origin of a public document so that it is accepted in another member country.

A company's constitutional document. It sets the rules for how the company is governed, including share classes and directors' powers.

A chronological record of who did what and when: who accessed, changed, approved or signed a document.

A formal decision of a company's board of directors, recorded in writing, for example approving a transaction or authorising someone to sign.

A copy of a document that an authorised person, such as a notary or lawyer, has confirmed to be a true copy of the original.

The steps a firm takes to accept a new client: identifying them, running the required checks, agreeing terms and collecting documents.

A documented judgment of how much money-laundering risk a specific client presents, based on who they are, where they operate and what service they need.

Conditions that must be met, such as a regulatory approval, before the parties are obliged to complete a transaction.

Separate identical copies of a contract, each signed by a different party, which together form one agreement.

The checks a firm must run on a client under anti-money laundering law: identify and verify the client and its beneficial owner, understand the purpose of the relationship, and keep it under review.

The duty under the GDPR to report a personal data breach to the supervisory authority within 72 hours of becoming aware of it, unless the breach is unlikely to put people at risk.

Two roles under the GDPR. The controller decides why and how personal data is processed. The processor handles data on the controller's behalf.

A contract between a data controller and a processor that sets out how personal data is handled. Article 28 of the GDPR requires one.

The physical location, usually a country or region, where an organisation's data is stored and processed.

How long an organisation keeps data before deleting it. The law sets both minimum periods, for example for anti-money laundering records, and limits under the GDPR.

Regulation (EU) 2022/2554. It sets rules for how financial entities manage technology risk, including risk from their suppliers, and has applied since 17 January 2025.

A cryptographic technique that signs with a private key and verifies with a public key, proving where a document came from and that it has not changed. Advanced and qualified electronic signatures are built on it.

A letter from seller to buyer that lists known exceptions to the warranties in a sale agreement, limiting the seller's liability for those matters.

The investigation a buyer or investor carries out into a company's legal, financial and commercial position before committing to a transaction.

The 2024 update to eIDAS, Regulation (EU) 2024/1183. It introduces the European Digital Identity Wallet and adds new trust services.

Regulation (EU) No 910/2014 on electronic identification and trust services. It sets the rules that make electronic signatures, seals and time stamps legally recognised across the EU.

A digital identity, issued or recognised by a government, used to prove who you are online. Under eIDAS, notified national schemes are recognised across EU member states.

The electronic equivalent of a company stamp. It is issued to a legal person, not an individual, and proves a document's origin and integrity.

The umbrella term in eIDAS for data in electronic form that a person uses to sign. It comes in three levels: simple, advanced and qualified.

Confirming a new or existing employee's identity, often remotely, before giving access to systems or asking them to sign employment documents.

Encryption in which data is scrambled on the sender's device and unscrambled only on the recipient's, so that no one in between, including the service provider, can read it.

The document in which a professional firm and its client agree the scope of work, fees and terms before the work begins.

Extra checks required when a client or transaction carries a higher money-laundering risk, such as a politically exposed person or a link to a high-risk country.

An arrangement in which a neutral third party holds money or documents and releases them only when agreed conditions are met.

The official lists, published by each EU and EEA member state, of qualified trust service providers and the qualified services they may offer. Anyone can use them to check a provider's status.

A digital wallet that every EU member state must offer under eIDAS 2.0. It lets people prove their identity, share verified attributes and sign with a qualified signature.

The intergovernmental body that sets global standards for combating money laundering and terrorist financing.

Regulation (EU) 2016/679, the EU's data protection law. It governs how organisations collect, use and store personal data.

An attack on a remote identity check in which fake images or video are fed directly into the verification system, bypassing the camera. Deepfakes are a common payload.

The business version of KYC: verifying that a company exists, who runs it and who ultimately owns it.

The process a regulated business uses to identify its customers and verify who they are, before the relationship starts and while it lasts.

The protection of confidential communication between a lawyer and a client. It limits, but does not remove, a lawyer's anti-money laundering reporting duties.

A document in which parties record their intention to do a deal and its main terms. It is usually non-binding, except for points such as confidentiality and exclusivity.

How much confidence an identity check provides. eIDAS defines three levels for electronic identification: low, substantial and high.

A check that the face in front of the camera belongs to a real, present person and not to a photo, video, mask or deepfake.

Information embedded in a signed document, such as certificate status and time stamps, so that the signature can still be validated years later, after the certificate has expired.

A login method that requires two or more different proofs of identity, such as a password plus a code or a fingerprint.

Reading the chip in a biometric passport or identity card with a phone to confirm the document is authentic and to retrieve the holder's data and photo.

Directive (EU) 2022/2555, the EU's cybersecurity law for essential and important entities. It sets security and incident-reporting duties.

A contract in which one or both parties agree to keep specified information confidential and to use it only for an agreed purpose.

Assurance that a signer cannot credibly deny having signed. It depends on how strongly the signature is tied to a verified identity.

Certification by a notary of a signature, a document or a transaction. Some transactions are valid only if completed before a notary, and the rules differ by country.

A business or profession that anti-money laundering law requires to carry out customer due diligence, including banks, auditors, accountants, tax advisors and, for certain transactions, lawyers and notaries.

The duty to keep checking a client relationship after onboarding, by reviewing transactions and keeping identity and risk information up to date.

A person who holds or has held a prominent public function, such as a minister, senior judge or member of parliament. Family members and close associates are treated with the same caution.

A document in which one person authorises another to act on their behalf, for example to sign contracts or to represent them in a transaction.

A certificate for electronic signatures that a qualified trust service provider issues after verifying the holder's identity. It links a signature to a named person.

An electronic signature created with a qualified signature creation device and based on a qualified certificate. Under eIDAS it has the same legal effect as a handwritten signature in every EU member state.

Proof, issued by a qualified trust service provider, that data existed at a specific moment. Under eIDAS it carries a legal presumption that the date and time are accurate and the data is intact.

Certified hardware or software that creates qualified signatures and keeps the signer's private key under their sole control. It can sit in a smart card or be managed remotely by a qualified provider.

A provider of trust services, such as signatures, seals and time stamps, that a national supervisory body has granted qualified status after an independent conformity assessment under eIDAS.

Using customer due diligence already carried out by another regulated firm instead of repeating it. Responsibility stays with the firm that relies.

Confirming that a person is who they claim to be without meeting them, usually by checking an identity document and matching it to a live image of the person.

Signing in which the signer's key is held in a secure device run by a trust service provider, not on a card or token, and is activated by the signer from a phone or browser.

Statements of fact that a seller makes about the company being sold. If they prove untrue, the buyer may have a claim.

The principle that a firm should match the depth of its checks to the level of money-laundering risk that each client and service presents.

Checking clients, owners and counterparties against official sanctions lists to make sure the firm is not dealing with a restricted person or entity.

A protected online space where a firm and its clients exchange documents and messages instead of using email.

The contract under which a buyer acquires the shares of a company from its shareholders. It sets the price, the conditions and the promises each side makes.

A contract between a company's shareholders that sets out how the company is run, how shares can be transferred and how disputes are resolved.

The check that confirms an electronic signature is genuine: the certificate was valid when the document was signed, the issuer is trusted, and the document has not changed since.

Two stages of a transaction. Signing is when the parties execute the agreement. Closing, also called completion, is when ownership and money actually change hands.

Any data in electronic form that someone uses to sign, such as a typed name or a ticked box. It counts as evidence, but gives the weakest proof of who actually signed.

A lighter level of checks allowed when a client or product presents a demonstrably low money-laundering risk. The client must still be identified.

The origin of the specific money used in a transaction or business relationship, for example a salary, a property sale or a loan.

How a person built up their total assets over time, as distinct from the origin of the money in a single transaction.

A report an obliged entity files with its national financial intelligence unit when it knows or suspects that funds are linked to crime.

A short, mostly non-binding document that summarises the main commercial terms of a proposed deal before the full contracts are drafted.

The natural person who ultimately owns or controls a company or other legal entity, directly or through a chain of ownership.

A tamper-evident digital credential, such as proof of employment or a diploma, that the holder keeps in a wallet and can present to anyone who needs to verify it.

A client workspace in which every participant's identity is verified before they get access, and documents are shared and signed in the same place.

Identity verification carried out over a live video call with a trained agent, who checks the person and their identity document on camera.

A secure online space where a seller shares confidential documents with potential buyers and their advisors during a transaction.

A handwritten signature made on paper with a pen. Some documents in some countries still require one by law.